Filesystem corruption bug in libdiskfs

[Abstract]

Hi.

In diskfs_rename_dir, filesystem corruption can result if a directory is
moved that by a user who cannot write to the parent directory. For
example:

$ sudo chown -R tla.tla /src/hurd
$ mv /src/hurd /home/tla
ext2fs.static: ..../libdiskfs/dir-renamed.c:202: diskfs_rename_dir:
Assertion `tmpnp == fnp' failed.

The cause of this is that the filesystem is modified (the source
directory's .. node is changed, and a reference is added to the target dir
to point to the source dir) before any check is made for writability to
the parent node.

-- 
Richard Smith